{"uid":"cap_hDXTGPi3VmjAU6nqDz_X_","slug":"pkgsafe-adrwent-fyi-c49abfb0","name":"pkgsafe.adrwent.fyi","description":"Call before installing or updating an npm or PyPI dependency. Returns a verdict (ok, caution, avoid, unknown) plus evidence signals: install script added, maintainer or publisher change, very recent publish, build provenance dropped, known malware and vulnerability advisories. A clean result is not a guarantee of safety.","url":"https://pkgsafe.adrwent.fyi/check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Exact package name, e.g. chalk or @types/node"},"version":{"type":"string","description":"Optional exact version; defaults to the latest"},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"Package registry"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_S5P_fumuHOW0Rm3ycSM8L","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks npm or PyPI packages for safety signals and returns a verdict (ok, caution, avoid, unknown) with evidence including malware flags, maintainer changes, install scripts, and vulnerability advisories.","exampleAgentPrompt":"Before I install it, can you check if the npm package 'lodash' is safe — look for any malware flags, maintainer changes, or suspicious install scripts?","exampleUseCases":[{"title":"Pre-install dependency safety check","prompt":"I'm about to add 'requests' from PyPI to my project — can you run a safety check on it and tell me if there are any red flags like malware advisories or recent suspicious publisher changes?"},{"title":"CI pipeline package vetting","prompt":"Before we merge this PR, check whether the npm package '@types/node' version 20.11.0 is safe to use — any caution or avoid verdicts I should know about?"},{"title":"Investigating a suspicious package","prompt":"Someone on my team flagged 'event-stream' on npm as potentially dangerous — can you look it up and tell me what safety signals come back, especially around install scripts or known malware?"}],"resultDescription":"Returns a safety verdict (ok, caution, avoid, or unknown) for the specified package, along with evidence signals such as: whether an install script was added, whether the maintainer or publisher changed, how recently the package was published, whether build provenance was dropped, and any known malware or vulnerability advisories. A clean verdict does not guarantee safety.","failureModes":["Unknown package name returns verdict 'unknown' with no signals","Unsupported ecosystem (not npm or pypi) results in validation error","Package version not found may fall back to latest or return unknown","Network or registry lookup failures may return unknown verdict","Very new or obscure packages may have limited signal data"],"whenToPreferThis":"Use this endpoint when an agent needs to vet an npm or PyPI package before installation or dependency updates, especially in automated CI/CD pipelines, dependency review workflows, or when a user asks whether a specific open-source library is safe. Prefer this over generic vulnerability scanners when you need a fast, per-package signal that includes supply-chain indicators like maintainer changes, install script additions, and publisher shifts — not just CVE lookups.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T12:30:04.348Z","isFirstParty":false,"canonicalSlug":"pkgsafe-adrwent-fyi-c49abfb0"}